Skip to content

Commit 6b07f2e

Browse files
mamicomamico
committed
codespell
1 parent 704e7db commit 6b07f2e

27 files changed

+2915
-2
lines changed

‎.meta.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ template = "default"
66
commit-id = "71d0218b"
77

88
[pyproject]
9-
codespell_skip = "*.min.js"
9+
codespell_skip = "*.min.js,*.ldif"
1010
codespell_ignores = "vew"
1111
dependencies_mappings = [
1212
"pytest-plone = ['pytest', 'plone.testing', 'plone.app.testing']",

‎pyproject.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ target-version = ["py38"]
7474

7575
[tool.codespell]
7676
ignore-words-list = "discreet,vew"
77-
skip = "*.po,*.min.js"
77+
skip = "*.po,*.min.js,*.ldif"
7878
##
7979
# Add extra configuration options in .meta.toml:
8080
# [pyproject]

‎tests/docker-test-openldap/.dockerignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.git
2+
.gitignore
3+
README.md

‎tests/docker-test-openldap/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
certs

‎tests/docker-test-openldap/CHANGELOG.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Changelog
2+
3+
4+
## v2.1 (rroemhild/test-openldap:2.1)
5+
6+
* Re-add PR #14: add_config_admin_pw
7+
8+
9+
## v2.0 (rroemhild/test-openldap:2.0)
10+
11+
* Set ports higher than 10000 (10389 / 10636)
12+
* Set user in dockerfile
13+
* Use tini to start slapd
14+
* Use CMD for slapd arguments
15+
16+
17+
### Breaking changes
18+
19+
Different port numbers than in the version before
20+
21+
* 380 -> 10389
22+
* 686 -> 10686

‎tests/docker-test-openldap/Dockerfile

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# FROM debian:bookworm-slim
2+
FROM debian:buster-slim
3+
4+
# Configuration Env Variables with defaults
5+
ENV DATA_DIR="/opt/openldap/bootstrap/data"
6+
ENV CONFIG_DIR="/opt/openldap/bootstrap/config"
7+
ENV LDAP_DOMAIN=planetexpress.com
8+
ENV LDAP_ORGANISATION="Planet Express, Inc."
9+
ENV LDAP_BINDDN="cn=admin,dc=planetexpress,dc=com"
10+
ENV LDAP_SECRET=GoodNewsEveryone
11+
ENV LDAP_CA_CERT="/etc/ldap/ssl/fullchain.crt"
12+
ENV LDAP_SSL_KEY="/etc/ldap/ssl/ldap.key"
13+
ENV LDAP_SSL_CERT="/etc/ldap/ssl/ldap.crt"
14+
ENV LDAP_FORCE_STARTTLS="false"
15+
16+
# Install slapd and requirements
17+
RUN apt-get update \
18+
&& apt-get dist-upgrade -y \
19+
&& DEBIAN_FRONTEND=noninteractive apt-get \
20+
install -y --no-install-recommends \
21+
xz-utils \
22+
slapd \
23+
ldap-utils \
24+
openssl \
25+
ca-certificates \
26+
&& rm -rf /var/lib/apt/lists/* \
27+
&& mkdir /etc/ldap/ssl /bootstrap
28+
29+
# Add s6-overlay
30+
# ARG S6_OVERLAY_VERSION=3.2.0.2
31+
# ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
32+
# RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
33+
# ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp
34+
# RUN tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz
35+
ADD https://github.com/just-containers/s6-overlay/releases/download/v2.2.0.1/s6-overlay-amd64-installer /tmp/
36+
RUN chmod +x /tmp/s6-overlay-amd64-installer && /tmp/s6-overlay-amd64-installer /
37+
38+
# ADD rootfs files
39+
ADD ./rootfs /
40+
41+
VOLUME ["/etc/ldap/slapd.d", "/etc/ldap/ssl", "/var/lib/ldap", "/run/slapd"]
42+
43+
EXPOSE 10389 10636
44+
45+
CMD ["/init"]
46+
47+
HEALTHCHECK CMD ["ldapsearch", "-H", "ldap://127.0.0.1:10389", "-D", "${LDAP_BINDDN}", "-w", "${LDAP_SECRET}", "-b", "${LDAP_BINDDN}"]

‎tests/docker-test-openldap/LETSENCRYPT_CERTS.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# LetsEncrypt Certificates for OpenLDAP
2+
- Use https://github.com/matrix-org/docker-dehydrated#behaviour
3+
```
4+
mkdir data
5+
echo "ldap.customdomain.com" > data/domains.txt
6+
7+
# create a docker-compose.yml file
8+
version: '2'
9+
services:
10+
dehydrated:
11+
image: docker.io/matrixdotorg/dehydrated
12+
restart: unless-stopped
13+
volumes:
14+
- ./data:/data
15+
environment:
16+
- DEHYDRATED_GENERATE_CONFIG=yes
17+
- DEHYDRATED_CA="https://acme-v02.api.letsencrypt.org/directory"
18+
# - DEHYDRATED_CA="https://acme-staging-v02.api.letsencrypt.org/directory"
19+
- DEHYDRATED_CHALLENGE="dns-01"
20+
- DEHYDRATED_KEYSIZE="4096"
21+
- DEHYDRATED_HOOK="/usr/local/bin/lexicon-hook"
22+
- DEHYDRATED_RENEW_DAYS="30"
23+
- DEHYDRATED_KEY_RENEW="yes"
24+
- DEHYDRATED_EMAIL="[email protected]"
25+
- DEHYDRATED_ACCEPT_TERMS=yes
26+
- PROVIDER=cloudflare
27+
- LEXICON_CLOUDFLARE_USERNAME
28+
- LEXICON_CLOUDFLARE_TOKEN
29+
30+
31+
#run docker compose
32+
docker-compose up
33+
```
34+
35+
# Copy Certificates to correct directory
36+
```
37+
cp fullchain-*.pem ldap/fullchain.crt
38+
cp cert-*.pem ldap/ldap.crt
39+
cp privkey-1623520297.pem ldap/ldap.key
40+
```

‎tests/docker-test-openldap/LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2016 Rafael Römhild
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in
13+
all copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎tests/docker-test-openldap/README.md

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
https://github.com/rroemhild/docker-test-openldap
2+
3+
# OpenLDAP Docker Image for testing
4+
5+
This Docker image provides an OpenLDAP Server for testing LDAP applications, i.e. unit tests. The server is initialized with the example domain `planetexpress.com` with data from the [Futurama Wiki][futuramawikia].
6+
7+
Parts of the image are based on the work from Nick Stenning [docker-slapd][slapd] and Bertrand Gouny [docker-openldap][openldap].
8+
9+
The Flask extension [flask-ldapconn][flaskldapconn] use this image for unit tests.
10+
11+
[slapd]: https://github.com/nickstenning/docker-slapd
12+
[openldap]: https://github.com/osixia/docker-openldap
13+
[flaskldapconn]: https://github.com/rroemhild/flask-ldapconn
14+
[futuramawikia]: http://futurama.wikia.com
15+
16+
17+
## Features
18+
19+
* Initialized with data from Futurama
20+
* Support for LDAP over TLS (STARTTLS) using a self-signed cert, or valid certificates (LetsEncrypt, etc)
21+
* memberOf overlay support
22+
* MS-AD style groups support
23+
* Supports Forced STARTTLS
24+
* Supports custom domain and custom directory structure
25+
26+
27+
## Usage
28+
29+
```
30+
docker pull ghcr.io/rroemhild/docker-test-openldap:master
31+
docker run --rm -p 10389:10389 -p 10636:10636 ghcr.io/rroemhild/docker-test-openldap:master
32+
```
33+
34+
## Testing
35+
36+
```
37+
# Enforce StartTLS with self-signed cert
38+
LDAPTLS_REQCERT=never ldapsearch -H ldap://localhost:10389 -ZZ -x -b "ou=people,dc=planetexpress,dc=com" -D "cn=admin,dc=planetexpress,dc=com" -w GoodNewsEveryone "(objectClass=inetOrgPerson)"
39+
40+
41+
# List all Users
42+
ldapsearch -H ldap://localhost:10389 -x -b "ou=people,dc=planetexpress,dc=com" -D "cn=admin,dc=planetexpress,dc=com" -w GoodNewsEveryone "(objectClass=inetOrgPerson)"
43+
44+
# Request StartTLS
45+
ldapsearch -H ldap://localhost:10389 -Z -x -b "ou=people,dc=planetexpress,dc=com" -D "cn=admin,dc=planetexpress,dc=com" -w GoodNewsEveryone "(objectClass=inetOrgPerson)"
46+
47+
# Enforce StartTLS
48+
ldapsearch -H ldap://localhost:10389 -ZZ -x -b "ou=people,dc=planetexpress,dc=com" -D "cn=admin,dc=planetexpress,dc=com" -w GoodNewsEveryone "(objectClass=inetOrgPerson)"
49+
50+
```
51+
52+
## Exposed ports
53+
54+
* 10389 (ldap)
55+
* 10636 (ldaps)
56+
57+
## Exposed volumes
58+
59+
* /etc/ldap/slapd.d
60+
* /etc/ldap/ssl
61+
* /var/lib/ldap
62+
* /run/slapd
63+
64+
65+
## LDAP structure
66+
67+
### dc=planetexpress,dc=com
68+
69+
| Admin | Secret |
70+
| ---------------- | ---------------- |
71+
| cn=admin,dc=planetexpress,dc=com | GoodNewsEveryone |
72+
73+
### ou=people,dc=planetexpress,dc=com
74+
75+
#### cn=Hubert J. Farnsworth,ou=people,dc=planetexpress,dc=com
76+
77+
| Attribute | Value |
78+
| ---------------- | ---------------- |
79+
| objectClass | inetOrgPerson |
80+
| cn | Hubert J. Farnsworth |
81+
| sn | Farnsworth |
82+
| description | Human |
83+
| displayName | Professor Farnsworth |
84+
| employeeType | Owner |
85+
| employeeType | Founder |
86+
| givenName | Hubert |
87+
| jpegPhoto | JPEG-Photo (630x507 Pixel, 26780 Bytes) |
88+
| mail | [email protected] |
89+
| mail | [email protected] |
90+
| ou | Office Management |
91+
| title | Professor |
92+
| uid | professor |
93+
| userPassword | professor |
94+
95+
96+
### cn=Philip J. Fry,ou=people,dc=planetexpress,dc=com
97+
98+
| Attribute | Value |
99+
| ---------------- | ---------------- |
100+
| objectClass | inetOrgPerson |
101+
| cn | Philip J. Fry |
102+
| sn | Fry |
103+
| description | Human |
104+
| displayName | Fry |
105+
| employeeType | Delivery boy |
106+
| givenName | Philip |
107+
| jpegPhoto | JPEG-Photo (429x350 Pixel, 22132 Bytes) |
108+
| mail | [email protected] |
109+
| ou | Delivering Crew |
110+
| uid | fry |
111+
| userPassword | fry |
112+
113+
114+
### cn=John A. Zoidberg,ou=people,dc=planetexpress,dc=com
115+
116+
| Attribute | Value |
117+
| ---------------- | ---------------- |
118+
| objectClass | inetOrgPerson |
119+
| cn | John A. Zoidberg |
120+
| sn | Zoidberg |
121+
| description | Decapodian |
122+
| displayName | Zoidberg |
123+
| employeeType | Doctor |
124+
| givenName | John |
125+
| jpegPhoto | JPEG-Photo (343x280 Pixel, 26438 Bytes) |
126+
| mail | [email protected] |
127+
| ou | Staff |
128+
| title | Ph. D. |
129+
| uid | zoidberg |
130+
| userPassword | zoidberg |
131+
132+
### cn=Hermes Conrad,ou=people,dc=planetexpress,dc=com
133+
134+
| Attribute | Value |
135+
| ---------------- | ---------------- |
136+
| objectClass | inetOrgPerson |
137+
| cn | Hermes Conrad |
138+
| sn | Conrad |
139+
| description | Human |
140+
| employeeType | Bureaucrat |
141+
| employeeType | Accountant |
142+
| givenName | Hermes |
143+
| mail | [email protected] |
144+
| ou | Office Management |
145+
| uid | hermes |
146+
| userPassword | hermes |
147+
148+
### cn=Turanga Leela,ou=people,dc=planetexpress,dc=com
149+
150+
| Attribute | Value |
151+
| ---------------- | ---------------- |
152+
| objectClass | inetOrgPerson |
153+
| cn | Turanga Leela |
154+
| sn | Turanga |
155+
| description | Mutant |
156+
| employeeType | Captain |
157+
| employeeType | Pilot |
158+
| givenName | Leela |
159+
| jpegPhoto | JPEG-Photo (429x350 Pixel, 26526 Bytes) |
160+
| mail | [email protected] |
161+
| ou | Delivering Crew |
162+
| uid | leela |
163+
| userPassword | leela |
164+
165+
### cn=Bender Bending Rodríguez,ou=people,dc=planetexpress,dc=com
166+
167+
| Attribute | Value |
168+
| ---------------- | ---------------- |
169+
| objectClass | inetOrgPerson |
170+
| cn | Bender Bending Rodríguez |
171+
| sn | Rodríguez |
172+
| description | Robot |
173+
| employeeType | Ship's Robot |
174+
| givenName | Bender |
175+
| jpegPhoto | JPEG-Photo (436x570 Pixel, 26819 Bytes) |
176+
| mail | [email protected] |
177+
| ou | Delivering Crew |
178+
| uid | bender |
179+
| userPassword | bender |
180+
181+
### cn=Amy Wong+sn=Kroker,ou=people,dc=planetexpress,dc=com
182+
183+
Amy has a multi-valued DN
184+
185+
| Attribute | Value |
186+
| ---------------- | ---------------- |
187+
| objectClass | inetOrgPerson |
188+
| cn | Amy Wong |
189+
| sn | Kroker |
190+
| description | Human |
191+
| givenName | Amy |
192+
| mail | [email protected] |
193+
| ou | Intern |
194+
| uid | amy |
195+
| userPassword | amy |
196+
197+
### cn=admin_staff,ou=people,dc=planetexpress,dc=com
198+
199+
| Attribute | Value |
200+
| ---------------- | ---------------- |
201+
| objectClass | Group |
202+
| cn | admin_staff |
203+
| member | cn=Hubert J. Farnsworth,ou=people,dc=planetexpress,dc=com |
204+
| member | cn=Hermes Conrad,ou=people,dc=planetexpress,dc=com |
205+
206+
### cn=ship_crew,ou=people,dc=planetexpress,dc=com
207+
208+
| Attribute | Value |
209+
| ---------------- | ---------------- |
210+
| objectClass | Group |
211+
| cn | ship_crew |
212+
| member | cn=Turanga Leela,ou=people,dc=planetexpress,dc=com |
213+
| member | cn=Philip J. Fry,ou=people,dc=planetexpress,dc=com |
214+
| member | cn=Bender Bending Rodríguez,ou=people,dc=planetexpress,dc=com |
215+
216+
217+
## JAAS configuration
218+
219+
In case you want to use this OpenLDAP server for testing with a Java-based
220+
application using JAAS and the `LdapLoginModule`, here's a working configuration
221+
file you can use to connect.
222+
223+
```
224+
other {
225+
com.sun.security.auth.module.LdapLoginModule REQUIRED
226+
userProvider="ldap://localhost:10389/ou=people,dc=planetexpress,dc=com"
227+
userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))"
228+
useSSL=false
229+
java.naming.security.principal="cn=admin,dc=planetexpress,dc=com"
230+
java.naming.security.credentials="GoodNewsEveryone"
231+
debug=true
232+
;
233+
};
234+
```
235+
236+
This config uses the admin credentials to connect to the OpenLDAP server and to
237+
submit the search query for the user that enters their credentials. As username
238+
the `uid` attribute of each entry is used.

0 commit comments

Comments
 (0)